PRIVACY STATEMENT FOR SENSITIVE AND PERSONAL DATA PROCESSING UNDER ART. 13 AND 14 OF THE EUGENERAL DATA PROTECTION REGULATION (GPDR) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016

Dear Patient,

Please find below some of the provisions of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (“Regulation“) on data processing performed at UPMC Institute for Health Chianciano Terme (“Center“).

WHAT IS UPMC INSTITUTE FOR HEALTH CHIANCIANO TERME?

UPMC Institute for Health Chianciano Terme is an outpatient medical center offering preventive medicine services with a special focus on digestive system and cardiovascular diseases, metabolic syndromes, and associated diseases. The goal of the Center is to offer personalized prevention by studying the cardiovascular and gastrointestinal systems (with a special focus on the liver and its functions), prescribing physical activity programs, and modifying lifestyles.

The Center is the result of a collaboration between the Municipality of Chianciano Terme, USL7 in Siena, Terme di Chianciano, and UPMC (University of Pittsburgh Medical Center), and benefits from the experience and know-how of UPMC and its hospitals (“UPMC Group“) with which there is an ongoing exchange of information. In its day-to-day operations the Center also utilizes data networks and information technology systems shared with the UPMC Group. As a consequence, patients referring to the Center are required to authorize the transfer of their data, including sensitive data[1] to the UPMC Group in the United States. According to EU regulations the laws in force in the United States fail to guarantee adequate levels of personal data protection. Pursuant to the Standard contractual clauses approved by the European Commission, the UPMC Group committed to adopt the necessary security measures to protect patient data.

In the scope of the Center, the following institutions operate in compliance with their respective autonomous authorizations:

  • UPMC Italy S.r.l. (“UPMCI“) that manages the medical gym (“Gym“): a state-of-the-art innovative facility offering educational and tutoring programs to have an healthy lifestyle for primary and secondary prevention of cardiovascular, hepatic, and metabolic diseases. . The Gym programs are addressed to both private patients and public patients under an agreement with the Italian NHS.
  • UPMC Italy Health Services S.r.l. (“UPMCIHS“), fully controlled by UPMCI and managing the diagnostic activity (“Diagnostic activity“): offers specialty consults and tests to private patients, with a focus on digestive system and cardiovascular diseases, metabolic syndromes, and associated diseases.

UPMCI and UPMCIHS share the administrative and support staff and the tools used for data processing, hence qualifying for these tasks as co-data controllers (“Co-data controllers“).  Clinical data are instead only processed by the institution treating the patient. If the patient decides to benefit from the services offered by both institutions, and provides his/her consent, the medical and nursing staff of UPMCI and UPMCIHS will also have access to the clinical data collected by the other institution. The co-data controllers have undersigned an agreement governing their roles and responsibilities. An extract of this agreement is available at the following link: https://www.upmcchianciano.it/accordo-di-contitolarita/

WHAT DATA WILL BE COLLECTED AND HOW?

The co-data controllers will collect your personal data (e.g., name, address), which will be processed in the scope of administrative and supporting tasks.

The institution you will refer to will ask you or third parties (e.g., your family doctor) to provide information on your health status (diseases, laboratory and diagnostic test results, ongoing therapies) and, if required for purpose of providing care, on your sex life or social and psychological sphere. In order to perform the clinical services it may become necessary to obtain some images of you for purpose of consults, also using telemedicine, performed by external professionals. Your data will be shared by the two institutions only if you give the authorization to do so.

WHY ARE MY DATA PROCESSED?
  1. In order for me to receive clinical services and also for administrative purposes

Your personal data will be collected by the institution you referred to and processed so that you may receive the necessary clinical services (outpatient procedures, prevention, diagnosis, care and rehabilitation activities) and also to fulfill the related administrative and accounting requirements. For the above activities, your consent to data processing is not required since this is performed for purposes of care and prevention (art. 9.2-h, Regulation).

  1. To conduct scientific studies and research in the medical field

With the purpose of improving its clinical services and to contribute to the development of general medical knowledge, UPMCI and UPMCIHS are involved in research projects (both internal and in collaboration with other centers, inside and outside the European Union). In particular, UPMCI and UPMCIHS carry out research activity in the areas of prevention, diagnosis, treatment and rehabilitation of medical-surgical pathologies (digestive system and cardiovascular diseases, metabolic syndromes, and associated diseases), clinical organization, and wellness and health in general. Many of these studies can be conducted using information collected during standard patient care activity or in the scope of clinical studies.

Participating to these research projects does not affect standard care and entails no additional tests or treatments. In order to protect the privacy, the patient’s identification data are removed from the information and clinical data used in these studies, and replaced with an alphanumerical code that does not allow to directly trace the patient’s identity. The list that allows associating this code with the patient’s data is owned exclusively by the principal investigator and filed as confidential documentation. The list of the ongoing studies is available at UPMCI and UPMCIHS and in the “Studies and Research” section of https://www.upmcchianciano.it/en divided according to the center UPMCI e UPMCIHS. For additional information you may request a meeting with the PI or contact at [•] for UPMCI, and [•] for UPMCIHS.

In particular, to protect privacy, encoded data is used during data processing and storage, and when forwarding data to the other subjects involved in the study (the list of centers involved in the various studies is available in the “Studies and Research” section of https://www.upmcchianciano.it/en). Access to data directly ascribable to the patient will only take place when extracting information from the original clinical documentation, while checking for correspondence between research data and data in medical records, or when this is required to update the research data. Data are transformed in an anonymous form after 10 years from the conclusion of the research projects. Encryption techniques are also adopted for data storage and transfer to prevent unauthorized access. Research outcomes are spread only in aggregated form, i.e. in ways that do not render identifiable the person concerned.

In order to use clinical information for purposes of research, and to store and analyze any potential residues of biological samples (which would otherwise be disposed), the patient must have previously expressed his/her consent (art. 9.2-a. Regulation).

Therefore, if you intend to authorize UPMCI and UPMCIHS (also in collaboration with other centers based in non-EU countries where compliance with EU regulations on appropriate levels of personal data protection may not be guaranteed) to utilize your clinical data already collected or that will collected in the scope of patient care (or during other research projects you were involved in) and any potential residues of biological samples obtained (which would otherwise be disposed), please express your consent checking the appropriate boxes. You may withdraw your consent to data processing and to the use of your biological materials for purpose of research at any time, and that this will not affect your treatment.

The Center also intends to participate in research projects regulated by laws, in the areas indicated above. In order to use data in the scope of these studies, however, it is not necessary to obtain the patients’ consents as these are provided for by law (art. 9.2-j, Regulation).

  1. Information material

If you provide consent (art 6.1-a, Regulation) you will receive (by email, mail or SMS) information on UPMCI and UPMCIHS projects and services, information campaigns, donations, and fund raising initiatives (e.g., 5×1000 tax share).

  1. To receive reminders for my upcoming appointments and instructions to prepare for scheduled tests

If you provide consent (art 6.2-a, Regulation) UPMCI and UPMCIHS will e-mail you information and instructions on how to prepare for your tests, and reminders for your upcoming appointments.

  1. To allow UPMCI and UPMCIHS health care providers to access documentation of my treatments at the two institutions, and have a more complete picture of my health status

UPMCI and UPMCIHS are equipped with an electronic archive tool called dossier that allows health care providers to access all the documentation on the procedures performed, also in the past, at the institution. This tool enables health care providers to access more complete information on the patient’s health status (clinical history) improving the treatment, and can only be activated with the patient’s consent (art. 9-2-a, Regulation). Therefore, only if you express consent to the creation of the dossier will your health care providers be able to view information regarding all your accesses to either institution, also at different times. Your dossier will be accessible to these health care providers (authorized to data processing under art. 29 of the Regulation) only for the time you are being treated at UPMCI or UPMCIHS. They will use credentials for authentication (user ID and password) associated with a specific access profile based on their role and function, to access the information and perform only the activities required to execute their tasks. In addition, all accesses and tasks performed are recorded in dedicated logs, and alerting systems are implemented to report any unauthorized access to the dossier. In no case shall managing bodies, insurance companies or employers have access to your dossier. You may decide for specific information to not be included in your dossier asking the director of health care activities to “obscure” the information. To file this request, contact upmcchianciano@upmc.it. You may also decide at any time to stop adding information to the dossier (while continuing take access the services provided by the institutions) and/or to withdraw your authorizations, view the accesses to your dossier (in this case, you will be informed of the institution that accessed the dossier and the date and time of access), and to request the rationale of your data processing or what criteria was used for their electronic processing. If you do not provide consent to create your dossier, or decide to withdraw consent at a later stage, the physicians and health care providers will only be able to access data relating to that particular treatment. In any case, the clinical information will always be available to the health care provider who entered them. Please note that health care providers not being able to access information on specific tests or treatments may negatively affect your treatment, entailing a release of liability for the health care providers.

Furthermore, if you refer to both institutions and provide your consent, all clinical staff will have access to your dossier that contains information on the care provided at both institutions, thus helping your recovery.

Co-data controllers also rely on the dossier to perform administrative tasks strictly related with the patient’s clinical pathway, allowing the staff responsible for these activities to only access the data required to execute their tasks. Finally, please note your dossier could be accessed, also without your consent, should this be deemed necessary to protect the physical safety of a third party or of the community (art. 9.2-i, Regulation).

  1. To verify the quality of patient care and treatments and schedule the clinical activity

If you express consent (art. 9.2-a, Regulation) UPMCI and UPMCIHS will use your data for monitoring and assessing the effectiveness of the clinical treatments delivered, the appropriateness and quality of care, and the risk factors for health provided by law and also for additional risks. In particular, the goal of UPMCI and UPMCIHS is to assess and compare the appropriateness, efficacy, effectiveness and efficiency of care delivered to different population groups or in different institutions, also with reference to specific diseases or health issues. These assessments will be carried out using data with no direct identification elements (name, surname, taxpayer’s code, etc.), therefore not allowing to trace the identity of the patient. This data will be processed and compared using computer tools with information managed by other clinical facilities.

HOW WILL MY DATA BE PROCESSED?

Data processing is performed using both paper and electronic tools, adopting appropriate safety measures to guarantee data confidentiality and security.

WHO WILL ACCESS MY PERSONAL DATA?

Your personal data will be processed by the clinical and administrative staff of UPMCI and UPMCIHS authorized for data processing and bound by professional secrecy and confidentiality.

Your data may also be shared with third parties, who, as independent data controllers or appointed data processors, provide ancillary services to the activities of UPMCI and UPMCIHS, such as:

  • family doctors;
  • external consultants,
  • insurance companies covering third-party civil liability, and professionals who may be involved in defending the Center and its personnel,
  • As for public patients treated at the Gym, the NHS for reimbursement of medical services, and other medical institutions monitoring and auditing the provision of clinical services;
  • maintenance firms;
  • other subjects providing services instrumental to the UPMCI and UPMCIHS operations.

The updated list of hospitals of the UPMC Group to which data is transferred, and of the appointed data processors is available on the home page of https://www.upmcchianciano.it/en/ or contacting upmcchianciano@upmc.it.

WHO WILL BE INFORMED OF MY HEALTH STATUS?

Information regarding your health status will only be provided to your relatives and friends, without prejudice to the provisions of law.

HOW LONG WILL MY DATA BE STORED?

In addition please note your personal data will be stored for the mandatory minimum retention period established by the Region of Lombardy in the “Massimario di scarto” enforced for the health health system (Version #4, “Titolario e Massimario del Sistema Sociosanitario Lombardo, già Sistema Sanitario e Sociosanitario di Regione Lombardia” approved by Legislative decree on welfare 11466 of 17 December 2015 and subsequent additions and amendments) and by the document issued by the General Archival Office regulating the archives of local health units and hospitals (so-called Schola Salernitana), available at http://www.archivi.beniculturali.it, as emended by other sources of regulations. For more information, please contact UPMCI, UPMCIHS, or the DPO at the addresses below.

WHAT ARE MY RIGHTS ACCORDING TO THE REGULATION?

Under art 15 et seq. of the Regulation, you have the right to obtain:

  • Confirmation that your personal data is stored in UPMCI and UPMCIHS’s archives, and to obtain a hardcopy or electronic copy, and information on data processing (purpose, data type, recipients, storage time, etc.).
  • Correction or integration of data.
  • Deletion of data if you withdraw your consent, or if there is no juridical basis for the processing.
  • If conditions apply, obtain personal data in a structured form.

Furthermore, we remind you that you can withdraw anytime consents already provided and, if conditions apply, you may file a complaint to the Authority for the Protection of Personal Data, as supervisory Authority according to the provided procedures. A template of the request may be found on the Italian Data Protection Authority website here.

Furthermore:

  • Once your dossier is created you may:
    • withdraw your consent to its implementation;
    • request to block some clinical events;
    • visualize the accesses that have taken place.
  • If you have provided consent to using your data for research purposes, to verify the quality and appropriateness of patient care and treatments, and to schedule clinical activity will be able to:
    • withdraw consent to the processing of your data and biological samples for research purposes, at any time, and this will not affect your treatment in any way;
    • request that your data used for research purposes be transformed into anonymous form;
    • obtain information on the projects in which your data have been used, and the list of the centers involved in these projects.

In addition, please note that should you request an integration, correction, or update, UPMCI and UPMCIHS will take note of the changes requested, without altering the background documentation.

HOW CAN I EXERCISE MY RIGHTS?

The rights may be exercised contacting the operations manager of the Center at upmcchianciano@upmc.it or the  UPMCI DPO at  DPO@upmcchianciano.it e UPMCIHS DPO at DPO@upmcihs.it  or at the following address: Viale Roma 97/99, 53042 Chianciano Terme (Italy).

UPMCI and UPMCIHS ADDRESSES

UPMC Italy S.r.l. and UPMC Italy Health Services, both with registered offices in Via Discesa dei Giudici 4, 90133 Palermo (Italy); UPMC Institute for Health Chianciano Terme with registered offices in Viale Roma  97/99, 53042 Chianciano Terme (Italy).